Suspicious ZimbraWeb App Password Creation
Detects the creation of an app-specific password named 'ZimbraWeb' via Zimbra SOAP API. This specific persistent credential name is a known mechanism utilized in the Operation GhostMail campaign by a Russian APT.
Sigma
